We have begun rolling out SEP14 and have noticed that the Virus Definition Version does not display the correct information for SEP14 clients. The Symantec registry keys have changed location for the virus definition version and both keys may exist if the machine was upgraded from SEP12 to SEP14.
On A SEP12 machine the current Virus Definition Version property evaluates correctly:
q: if (exists key "HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\Symantec Endpoint Protection\CurrentVersion\SharedDefs" whose (exists value "NAVCORP_70" of it) of registry) then ((if (exists "\" of it AND following text of last "\" of it contains ".") then (preceding text of last "." of following text of last "\" of it & ", rev. " & following text of last "." of following text of last "\" of it) else (it)) of (value "NAVCORP_70" of key "HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\Symantec Endpoint Protection\CurrentVersion\SharedDefs" of registry as string)) else (if (exists key "HKEY_LOCAL_MACHINE\Software\Symantec\SharedDefs" whose (exists value "NAVCORP_70" of it) of registry) then ((if (exists "\" of it AND following text of last "\" of it contains ".") then (preceding text of last "." of following text of last "\" of it & ", rev. " & following text of last "." of following text of last "\" of it) else (it)) of (value "NAVCORP_70" of key "HKEY_LOCAL_MACHINE\Software\Symantec\SharedDefs" of registry as string)) else ("<Not Installed>"))
A: 20171109, rev. 001
T: 0.356 ms
On a SEP14 Machines you get either “Not installed” if only the new SEP14 registry key exists or it evaluates incorrectly because both SEP12 and SEP14 registry keys are present. A SEP14 machine that had upgraded from SEP12.
Current Symantec Endpoint Protection Analysis (reporting incorrect virus definition versions on SEP14)
q: if (exists key "HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\Symantec Endpoint Protection\CurrentVersion\SharedDefs" whose (exists value "NAVCORP_70" of it) of registry) then ((if (exists "\" of it AND following text of last "\" of it contains ".") then (preceding text of last "." of following text of last "\" of it & ", rev. " & following text of last "." of following text of last "\" of it) else (it)) of (value "NAVCORP_70" of key "HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\Symantec Endpoint Protection\CurrentVersion\SharedDefs" of registry as string)) else (if (exists key "HKEY_LOCAL_MACHINE\Software\Symantec\SharedDefs" whose (exists value "NAVCORP_70" of it) of registry) then ((if (exists "\" of it AND following text of last "\" of it contains ".") then (preceding text of last "." of following text of last "\" of it & ", rev. " & following text of last "." of following text of last "\" of it) else (it)) of (value "NAVCORP_70" of key "HKEY_LOCAL_MACHINE\Software\Symantec\SharedDefs" of registry as string)) else ("<Not Installed>"))
A: 20120308, rev. 002
T: 0.318 ms
The correct registry key and correct virus def version on same SEP14 machine:
q: if (exists key "HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\Symantec Endpoint Protection\CurrentVersion\SharedDefs\SDSDefs" whose (exists value "NAVCORP_70" of it) of registry) then ((if (exists "\" of it AND following text of last "\" of it contains ".") then (preceding text of last "." of following text of last "\" of it & ", rev. " & following text of last "." of following text of last "\" of it) else (it)) of (value "NAVCORP_70" of key "HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\Symantec Endpoint Protection\CurrentVersion\SharedDefs\SDSDefs" of registry as string)) else (if (exists key "HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\Symantec Endpoint Protection\CurrentVersion\SharedDefs\SDSDefs" whose (exists value "NAVCORP_70" of it) of registry) then ((if (exists "\" of it AND following text of last "\" of it contains ".") then (preceding text of last "." of following text of last "\" of it & ", rev. " & following text of last "." of following text of last "\" of it) else (it)) of (value "NAVCORP_70" of key "HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\Symantec Endpoint Protection\CurrentVersion\SharedDefs\SDSDefs" of registry as string)) else ("<Not Installed>"))
A: 20171109, rev. 001
T: 0.316 ms
To get the correct output, I have combined the scripts with the SEP14 check first so if the key is there it will report on that one correctly and if its not there will fail over to the SEP12 registry location. Same SEP14 machine.
q: if (exists key "HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\Symantec Endpoint Protection\CurrentVersion\SharedDefs\SDSDefs" whose (exists value "NAVCORP_70" of it) of registry) then ((if (exists "\" of it AND following text of last "\" of it contains ".") then (preceding text of last "." of following text of last "\" of it & ", rev. " & following text of last "." of following text of last "\" of it) else (it)) of (value "NAVCORP_70" of key "HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\Symantec Endpoint Protection\CurrentVersion\SharedDefs\SDSDefs" of registry as string)) else if (exists key "HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\Symantec Endpoint Protection\CurrentVersion\SharedDefs\SDSDefs" whose (exists value "NAVCORP_70" of it) of registry) then ((if (exists "\" of it AND following text of last "\" of it contains ".") then (preceding text of last "." of following text of last "\" of it & ", rev. " & following text of last "." of following text of last "\" of it) else (it)) of (value "NAVCORP_70" of key "HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\Symantec Endpoint Protection\CurrentVersion\SharedDefs\SDSDefs" of registry as string)) else if (exists key "HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\Symantec Endpoint Protection\CurrentVersion\SharedDefs" whose (exists value "NAVCORP_70" of it) of registry) then ((if (exists "\" of it AND following text of last "\" of it contains ".") then (preceding text of last "." of following text of last "\" of it & ", rev. " & following text of last "." of following text of last "\" of it) else (it)) of (value "NAVCORP_70" of key "HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\Symantec Endpoint Protection\CurrentVersion\SharedDefs" of registry as string)) else (if (exists key "HKEY_LOCAL_MACHINE\Software\Symantec\SharedDefs" whose (exists value "NAVCORP_70" of it) of registry) then ((if (exists "\" of it AND following text of last "\" of it contains ".") then (preceding text of last "." of following text of last "\" of it & ", rev. " & following text of last "." of following text of last "\" of it) else (it)) of (value "NAVCORP_70" of key "HKEY_LOCAL_MACHINE\Software\Symantec\SharedDefs" of registry as string)) else ("<Not Installed>"))
A: 20171109, rev. 001
T: 0.743 ms
Please update the Symantec Endpoint Analysis so it reports correctly for SEP14 and older versions of Symantec.
Thanks,
Scott